Hi Loyd, Dan, Thank you for your helpful responses.
On Mon, Dec 6, 2010 at 4:10 PM, dan (ddp) <[email protected]> wrote: > On Mon, Dec 6, 2010 at 2:49 PM, Christopher Moraes > <[email protected]> wrote: > > Hi, > > I have a centralized syslog that contains logs from Windows and Unix > hosts > > (and devices). The logs are all single line logs, but with different > > signatures. > > E.g. the windows event log format is > > Sep 18 00:01:06 TXXXXXX2.syxxxxxd.com MSWinEventLog ....... > > A sample unix log format is > > Sep 18 00:01:02 10.111.114.88 sshd: ..... > > I have setup ossec to read the file and specified the <log_format> as > > "syslog". > > However, whenever ossec comes across the windows event logs, it throws an > > alert "Unknown problem somewhere in the system". > > I went through the syslog_rules.xml and found that this error is caused > > because the log is not in the format supported by the syslog decoder. > > Is there anyway I can get ossec to read the log line and check which > decoder > > matches the log before processing the log? > > Thanks and regards, > > Chris > > > > If the format of the messages is wrong, they won't be decoded > correctly. You have messages in non-syslog format going to a file > where ossec expects syslog formatted messages. As you can see, this > will cause issues. > > > > > On Tue, Oct 5, 2010 at 2:58 PM, Christopher Moraes < > [email protected]> > > wrote: > >> > >> Hi, > >> We're using syslog-ng to centralize logs on a server. The way the > system > >> is setup is that *all* system logs (for unix, windows, apache, iis, etc) > get > >> written to a single file on the syslog server. > >> Can OSSEC be configured to analyse this type of combined syslog file? > >> Regards, > >> Chris > >> > >> > > > > >
